Have you made sure to clear all cookies, cache, auth sessions, and the like? It could be that even though you left the inbox for toto, because you are directly putting tutu in there, it's logging you in.

I tested it with a new opened browser. Once I'm logged with one account (eg. toto@domain.com), I am able to see all accounts of the domain (tutu@domain.com, titi@domain.com, tata@domain.com, ....) by just changing the url parameter.

I don't use the latest 4.5 version of Zimbra OSS. I'll try with the latest one, and the NE edition ...